Part of the AI Regulation News hub. See Asia-Pacific AI Regulation.
China's September cabin-data guide sets out voice-record controls and on-vehicle processing requirements
Correction and update, October 1, 2026. TC260 released a final practice guide on September 15. This article now describes that text and corrects the displayed publication date to August 21. The final voice-conversation section does not contain the model-training clause reported in our earlier draft coverage. The old consultation URL could not be recovered for this review, so that earlier quotation is no longer presented as verified current guidance.
The released guide gives users controls over in-car voice conversations and their records. Its four-clause voice section differs from the draft provision previously described here; sensitive-data consent remains addressed elsewhere in the guide.
What changed: The TC260 Secretariat released Cybersecurity Standard Practice Guide: Cabin Data Processing Security Requirements on September 15, 2026. Its reference is TC260-PG-202615A, version 1.0-202609.
Scope: Section 1 covers cabin-data processing and says the guide may inform cabin-function design and development. Section 3.2 identifies vehicle manufacturers, component and software suppliers, and in-vehicle application providers as examples of cabin-data processors.
Status: This is a published standards-related technical practice guide. Its foreword describes a standardisation guidance purpose. It is not an announcement of a newly enacted statute, and this article does not determine the separate legal effect of every law or standard it references.
Primary sources: TC260 release notice, September 15, 2026 · Released guide PDF
Informational analysis for working professionals, not legal advice. Confirm applicable obligations with qualified counsel.
- Instrument
- Cybersecurity Standard Practice Guide: Cabin Data Processing Security Requirements
- Reference
- TC260-PG-202615A, v1.0-202609
- Authority
- TC260 Secretariat
- Jurisdiction
- China
- Release date
- September 15, 2026
- Status
- Published technical practice guide
- Primary source
- TC260 release notice and linked final PDF
The final voice-conversation section
Section 5.2 contains four clauses. Users should have a way to turn the intelligent voice-conversation function on and off, refuse storage of records while the function remains active, and inspect or delete the records it holds. Where records need to be processed outside the vehicle, anonymisation should first take place in the vehicle.
The released section ends at clause (d). It does not contain the explicit model-training and product-optimisation consent clause described in our earlier draft coverage. That absence does not establish an exemption for training. Section 4(d) separately addresses identification of sensitive personal information and obtaining separate consent before processing it.
The guide defines intelligent conversation in section 3.3 as voice interaction supporting multi-turn contextual understanding and continuous interaction, including cabin control, information retrieval and questions and answers. That definition makes this relevant to in-car conversational assistants without extending its scope to every AI system.
What stays in the vehicle
Section 4(e) says cabin data should not be transmitted outside the vehicle except for the specific circumstances referenced in GB/T 41871-2022 section 6.2. We have not reviewed those referenced exceptions. They must not be omitted when describing the guide's on-vehicle rule.
Section 5.1 addresses voice activation. Temporarily stored wake-word audio should be kept no longer than needed for recognition. Voiceprint data should be stored separately on the vehicle rather than alongside identity information. The guide also addresses ending collection when no valid command arrives and handling false activation.
For driver-state monitoring, section 5.3 says users should be told where the camera is located, limits the collection area to the area directly above the main driver's seat, and calls for separate on-vehicle storage of facial data. The collected facial data should be processed inside the vehicle.
Logs and supplier responsibilities
Section 6(b) specifies complete processing-operation logs for at least six months. Activities involving sensitive personal information require such logs for at least three years. These periods concern logs. They do not create a blanket instruction to retain raw audio for six months or three years.
Section 6(g) says vehicle manufacturers should understand how the components and applications in their vehicles collect and transmit cabin data. It also calls for contractual controls over suppliers and in-vehicle application providers, and supervision of contractual performance.
A product review can therefore start with the voice controls, storage choice, access and deletion functions, off-vehicle processing flow and supplier agreements. Whether an implementation meets applicable legal requirements needs separate assessment of the referenced instruments and the actual processing.
What this review establishes
We read the September 15 release notice and the complete linked final guide. The cover, numbered sections and source references support the account above. The old consultation URL returned an error during this review; we have not independently recovered the earlier draft text and do not rely on its old quotation as proof of the final guide.
We have not reviewed each referenced law and standard, determined how authorities will apply the guide, or examined any vehicle implementation. Nothing here establishes that a particular training use is permitted or exempt.
Source File
TC260 final release notice and TC260-PG-202615A PDF.
Check the cover for version 1.0-202609; section 5.2 on printed page 4 for its four clauses; section 4(d)-(e) for sensitive-data consent and the referenced transmission exceptions; and section 6(b) for operation-log retention.
应为用户提供开启和关闭车载智能语音对话功能的方式 · TC260-PG-202615A, section 5.2(a), September 2026
FAQ
Is the consultation still open?
The September 15 release is a published practice guide, TC260-PG-202615A, version 1.0-202609. This article no longer presents the earlier draft consultation as open.
Does the final guide contain the draft model-training consent clause?
Final section 5.2 has four clauses covering voice-function controls, refusal to save records, access and deletion, and anonymisation before off-vehicle processing. It does not contain the model-training clause described in the earlier article. Section 4(d) separately addresses consent for sensitive personal information; this does not establish that model training is exempt from applicable law.
Must all cabin data stay in the vehicle?
Section 4(e) states an on-vehicle rule with express exceptions referenced to GB/T 41871-2022 section 6.2. Section 5.2(d) says voice conversation records that need off-vehicle processing should first be anonymised in the vehicle. We have not reviewed the referenced exceptions here.
Are the six-month and three-year periods audio-retention rules?
No. Section 6(b) concerns complete processing-operation logs: at least six months generally and at least three years for activities involving sensitive personal information. It does not set those periods as blanket retention requirements for raw cabin audio.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.